日本電腦網路危機處理暨協調中心 (JPCERT/CC) 日前發布資安警訊,指出一種全新駭侵攻擊方式;駭侵者利用嵌入在 PDF 檔中的惡意 Word 檔案來逃避防毒防駭軟體的偵測,成功發動攻擊。
JPCERT/CC 是在 2023 年 7 月開始觀察到利用這種技術發動的資安攻擊案例。該單位分享了一個樣本檔案,是一種集多種檔案格式於一身的特殊檔案,可以同時使用不同的軟體來開啟;多數的防毒防駭軟體,在對該樣本檔案進行掃瞄偵測時,會把該檔案當做是 PDF 檔,但該樣本檔同時也可以由 Microsoft Word 來開啟。
JPCERT/CC 指出,該樣本檔一旦由受害者以 Microsoft Word 開啟,即會執行其內含的 VBS 巨集,並且下載一個含有惡意軟體的 MSI 檔案,安裝在受害者的 Windows 系統中。
資安專家指出,駭侵者經常利用這種多合一格式檔案來放置內含 VBS 惡意巨集程式碼的 Word 檔案,由於掃毒軟體會把這種檔案當成相對無害的 PDF 檔,因此往往能成功避開系統上安裝的資安防護機制。
資安專家分析指出,雖然 JPCERT/CC 沒有進一步公開樣本檔內含的惡意軟體攻擊行為與方式,但一般來說,用戶可以在 Microsoft Office 相關設定中,停用巨集的自動執行功能,這樣就能夠阻止這類多合一格式惡意檔案的執行。
此外,還是有一些如 OLEVBA 之類的資安防護軟體,可以偵測到這類多合一格式的惡意檔案內含的惡意程式碼。
建議使用者避免開啟來路不明的任何檔案,系統管理者也應提防這類攻擊,在布署軟體時強制關閉 Office 巨集的自動執行。
Google Cloud 旗下的資安團隊 Cybersecurity Action Team,在近期發表的 2023 年資安趨勢報告「Threat Horizons: August 2023 Threat Horizons Report」中指出,愈來愈多駭侵者利用「版本置換」(Versioning)的方式,通過 Google Play Store 的上架前檢查流程並成功上架。
在這份報告中,Google 先列出 Google Cloud 2023 年第一季統計所得的雲端服務攻擊原因,其中未設定密碼或密碼不夠強,其佔比高達 54.8%;其他原因還包括資安設定錯誤(19%)、敏感 UI 或 API 曝光(11.9%)、登入資訊遭竊(7.1%)、使用軟體存有漏洞(2.4%)等。
此外,在這份報告中,Google Cloud 資安團隊也解釋 Google Play Store 中會有惡意軟體上架的原因。駭侵者多半利用一種稱為「版本置換」(Versioning)的手法,先把不含任何惡意軟體的最初版本上架到 Google Play Store 中,以通過各種資安檢查流程,成功上架到 Googel Play Store 上;待使用者下載安裝後,再以版本更新的機制,將惡意軟體酬載自第三方伺服器安裝到使用者已安裝在裝置中的 App 內。
雖然 Google 在其 Play Store 使用規範中明白規定,禁止任何軟體使用 Google Play 官方提供的更新機制以外的方式,對已下載安裝的軟體進行更新、變更或替換,也禁止自第三方伺服器下載任何可執行檔,例如 dex、JAR 等檔案,但顯然有不少 App 並未遵守這個禁令,仍會在使用者下載完沒有問題的版本後,再透過第三方伺服器安裝惡意軟體程式碼酬載。
建議 Android 使用者即使在官方 Google Play Store 中下載安裝軟體,也應在下載前先檢視其他使用者的意見回饋,如有大量負評則應避免下載。
We use cookies on our website to give you the most relevant experience by remembering your preferences and repeat visits. By clicking “Accept”, you consent to the use of ALL the cookies.
This website uses cookies to improve your experience while you navigate through the website. Out of these, the cookies that are categorized as necessary are stored on your browser as they are essential for the working of basic functionalities of the website. We also use third-party cookies that help us analyze and understand how you use this website. These cookies will be stored in your browser only with your consent. You also have the option to opt-out of these cookies. But opting out of some of these cookies may affect your browsing experience.
Necessary cookies are absolutely essential for the website to function properly. These cookies ensure basic functionalities and security features of the website, anonymously.
Cookie
Duration
Description
cookielawinfo-checkbox-analytics
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional
11 months
The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance
11 months
This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy
11 months
The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.
Functional cookies help to perform certain functionalities like sharing the content of the website on social media platforms, collect feedbacks, and other third-party features.
Performance cookies are used to understand and analyze the key performance indexes of the website which helps in delivering a better user experience for the visitors.
Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate, traffic source, etc.
Advertisement cookies are used to provide visitors with relevant ads and marketing campaigns. These cookies track visitors across websites and collect information to provide customized ads.